10-10
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
Chapter 10 Configuring 802.1x Port-Based Authentication
Configuring 802.1x Authentication
The maximum size of the per-user ACL is 4000 ASCII characters.
For examples of vendor-specific attributes, see the “Configuring the Switch to Use Vendor-Specific
RADIUS Attributes” section on page 9-29. For more information about configuring ACLs, see
Chapter 31, “Configuring Network Security with ACLs.”
To configure per-user ACLs, you need to perform these tasks:
• Enable AAA authentication.
• Enable AAA authorization by using the network keyword to allow interface configuration from the
RADIUS server.
• Enable 802.1x.
• Configure the user profile and VSAs on the RADIUS server.
• Configure the 802.1x port for single-host mode.
802.1x and Switch Stacks
If a switch is added to or removed from a switch stack, 802.1x authentication is not affected as long as
the IP connectivity between the RADIUS server and the stack remains intact. This statement also applies
if the stack master is removed from the switch stack. Note that if the stack master fails, a stack member
becomes the new stack master by using the election process described in Chapter 5, “Managing Switch
Stacks,” and the 802.1x authentication process continues as usual.
If IP connectivity to the RADIUS server is interrupted because the switch that was connected to the
server is removed or fails, these events occur:
• Ports that are already authenticated and that do not have periodic re-authentication enabled remain
in the authenticated state. Communication with the RADIUS server is not required.
• Ports that are already authenticated and that have periodic re-authentication enabled (with the dot1x
re-authentication global configuration command) fail the authentication process when the
re-authentication occurs. Ports return to the unauthenticated state during the re-authentication
process. Communication with the RADIUS server is required.
For an ongoing authentication, the authentication fails immediately because there is no server
connectivity.
If the switch that failed comes up and rejoins the switch stack, the authentications might or might not
fail depending on the boot-up time and whether the connectivity to the RADIUS server is re-established
by the time the authentication is attempted.
To avoid loss of connectivity to the RADIUS server, you should ensure that there is a redundant
connection to it. For example, you can have a redundant connection to the stack master and another to a
stack member, and if the stack master fails, the switch stack still has connectivity to the RADIUS server.
Configuring 802.1x Authentication
These sections describe how to configure 802.1x port-based authentication on your switch:
• Default 802.1x Configuration, page 10-11
• 802.1x Configuration Guidelines, page 10-12
• Upgrading from a Previous Software Release, page 10-13
• Configuring 802.1x Authentication, page 10-13 (required)
To Next Page
Loading...
Need help?
General